NIST SP 800-171 Security Requirements (SSP & POA&M)

At a Glance

Who it applies to

Contractors whose systems handle CUI / Covered Defense Information — required by DFARS 7012 and CMMC Level 2

What it obligates

Implement the SP 800-171 security requirements (110 in Rev. 2, reorganized in Rev. 3) across 14 families

Governing authority

NIST Special Publication 800-171, incorporated by DFARS 252.204-7012

Key documents

System Security Plan (SSP) describing implementation, and a Plan of Action & Milestones (POA&M) for gaps

The stakes

It's the technical backbone of DoD cybersecurity — CMMC assessments and SPRS scores measure it directly

What It Is

NIST Special Publication 800-171, 'Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,' is the technical security standard at the heart of federal (especially DoD) cybersecurity for contractors. It sets out the security requirements a non-federal organization must meet to protect CUI on its own systems. Revision 2 organizes 110 security requirements into 14 families — access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. (NIST published Revision 3 in 2024, which restructures and updates the requirements; contracts specify which revision applies.) Two documents operationalize it. The System Security Plan (SSP) describes how you have implemented each requirement — the boundary of your system, the controls in place, and how they work. The Plan of Action & Milestones (POA&M) lists any requirement not yet fully met, with a plan and date to close the gap. NIST SP 800-171 is not itself a clause; it becomes binding because DFARS 252.204-7012 requires contractors handling Covered Defense Information to implement it, DFARS 252.204-7019/7020 require you to self-assess against it and post a score to SPRS, and CMMC Level 2 requires a third party to assess it. In plain terms: 800-171 is the checklist, the SSP is your proof you did it, and the POA&M is your honest list of what's left.

When It Applies

• Whenever a DoD contract involves Covered Defense Information — DFARS 252.204-7012 requires SP 800-171 implementation.
• When you compute and post a NIST SP 800-171 DoD Assessment score to SPRS (DFARS 7019/7020).
• When you undergo a CMMC Level 2 assessment, which is based on the SP 800-171 requirements.
• Increasingly on non-DoD contracts as agencies adopt SP 800-171 for CUI under the emerging governmentwide FAR rule.

Key Features

The SDVOSB Angle

NIST SP 800-171 is where the real cost of DoD cybersecurity lands on a small SDVOSB, and where honesty pays. The self-assessment (posted to SPRS) uses a scoring methodology that starts at 110 and subtracts weighted points for each unmet requirement — so a firm early in its journey can post a low or negative score, which is legal as long as it's accurate and paired with a POA&M. The danger is inflating the score to look award-ready: because DFARS 7019/7020 make the score a representation and CMMC will bring a third-party assessor to check it, an overstated SSP is a documented False Claims Act exposure that has already produced settlements against contractors. Build a genuine SSP scoped to only the systems that actually touch CUI (shrinking the boundary shrinks the cost), track gaps in a real POA&M, and treat 800-171 maturity as a competitive discriminator — many small competitors can't show a credible score. Price the assessment and remediation into your bid using the Price-to-Win build-up.

How to Comply

1. Confirm which revision (Rev. 2 or Rev. 3) your contract requires and scope the system boundary that handles CUI.
2. Assess your implementation of each SP 800-171 requirement and write a genuine System Security Plan (SSP).
3. Record every unmet requirement in a Plan of Action & Milestones (POA&M) with a realistic remediation date.
4. Compute the NIST 800-171 DoD Assessment score accurately and keep the evidence behind it.
5. Remediate high-value gaps first (they carry the most points) and keep the SSP current as your systems change.

Watch Out For

• Overstating the SSP or the SPRS score — it's a representation with real False Claims Act exposure.
• Scoping the whole company into the boundary when only a few systems touch CUI, multiplying the cost.
• Confusing Rev. 2 and Rev. 3 requirements — implement the revision your contract actually names.
• Treating the POA&M as permanent — open items lower your score and, under CMMC, are time-limited.

Run the Numbers

Frequently Asked

Primary Sources

• NIST SP 800-171 — Protecting CUI in Nonfederal Systems
• DFARS 252.204-7012 — Safeguarding Covered Defense Information
• DoD NIST SP 800-171 Assessment Methodology (SPRS)

Plain-English reference, not legal advice. Cybersecurity and information-safeguarding rules are fact-specific and change often — the FAR, DFARS, NIST publications, and the CMMC program rule are amended and phased in over time. Always read the current FAR/DFARS text and the safeguarding clauses in your specific contract, check the version of NIST SP 800-171 your contract requires, confirm the SPRS and CMMC requirements with the contracting officer, and consult qualified counsel or a cybersecurity professional before relying on a compliance position or making a certification.

Related Safeguarding Requirements

Systems You’ll Use

Clauses That Apply

How It Plays by Contract Type

Forms You’ll Use

Terms Used on This Page

In the FAQ Knowledge Base